Hetzner runner snapshot: bake in GraalVM + Playwright browsers for acceptance suite

[fabapp2]

Background

promptlm-app's .github/workflows/acceptance.yml provisions an ephemeral cx33/fsn1 Hetzner VM (via Cyclenerd hcloud-github-runner@v1) using the snapshot identified by the org variable HETZNER_RUNNER_SNAPSHOT_ID, with a pre_runner_script fallback that installs JDK 17/21, Maven, Node 22, pnpm, yarn, jq, etc. on a fresh ubuntu-24.04 image.

The new native-app acceptance suite (see promptlm-app design notes — acceptance-tests plan) adds two requirements that the current snapshot doesn't yet meet:

1. GraalVM CE 21 with native-image — needed for mvn -B -Pnative -pl apps/promptlm-cli,apps/promptlm-webapp -am -DskipTests package. Installing GraalVM + native-image from cold on cx33 adds ~5 min to every acceptance run.
2. Playwright browsers pre-installed — npx playwright install --with-deps chromium adds ~90s on cold start and pulls ~250 MB of fonts/libs each time.

Both are paid once per snapshot bake instead of once per acceptance run.

Asks

Update the snapshot-bake job in this repo so the snapshot referenced by HETZNER_RUNNER_SNAPSHOT_ID includes:

• GraalVM CE 21 with native-image available on PATH (verify with native-image --version)
  • Match the JDK 21 distribution shipped today (Temurin → GraalVM CE 21 — pick one that's reproducible by ID; SDKMAN or the official Oracle/GraalVM tarball both work)
  • JAVA_HOME must be selectable so existing workflows that pin Temurin via setup-java continue to work; recommend leaving Temurin as the default JAVA_HOME and adding GRAALVM_HOME separately
• Playwright Chromium + system deps pre-installed under a known cache dir
  • npx playwright install --with-deps chromium run as the runner user, or root-cached and symlinked
  • Document where the cache lives so PLAYWRIGHT_BROWSERS_PATH can point at it in the consuming workflows
• Update docs/hetzner-runners.md to list both additions, the disk-size impact, and the verification commands
• Keep the pre_runner_script fallback in promptlm-app/.github/workflows/acceptance.yml working for snapshot-less runs (the fallback should detect their absence and install them on the fly, so the snapshot bake is a perf optimisation, not a hard dep)

Acceptance criteria

1. A fresh acceptance run on promptlm-app (main, full profile) that previously took the cold-install time completes ≥ 5 min faster when consuming the new snapshot.
2. native-image --version, mvn -Pnative package on a tiny sample, and npx playwright --version all succeed in a runner spawned from the new snapshot without running pre_runner_script.
3. The existing cx33/fsn1 allocation still works (no SKU drift).

Notes

• Same snapshot is also useful for any future repo that wants Playwright + native-image; the bake should be repo-agnostic.
• Snapshot size will grow (~1.5 GB for GraalVM, ~0.4 GB for Playwright). cx33's 80 GB disk has plenty of headroom.
• Downstream PR in promptlm-app will set PLAYWRIGHT_BROWSERS_PATH and remove the inline playwright install --with-deps from acceptance-tests/pom.xml's exec-maven-plugin once the snapshot is rolled.

Context links

• promptlm-app/.github/workflows/acceptance.yml — current provisioning pattern (lines 102–155)
• promptlm-app/acceptance-tests/pom.xml — current Playwright install step (generate-test-resources phase)